Phorum 3.x - 'profile.php?target' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9882/info It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidde...

Phorum 3.x - 'register.php' HTTP_REFERER Cross-Site Scripting

source: https://www.securityfocus.com/bid/9882/info It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidde...

Phorum < 5.0.3 Beta - Cross Site Scripting

Phorum Cross Site Scripting Vendor: Phorum Product: Phorum Version: tag, it will allow for pretty much any thing else, and most of you know it is not hard to execute javascript inside of a tag which is allowed. This same vulnerability also exists in "register.php" And while not the exact same, a...

CVE-2004-0034

Multiple cross-site scripting XSS vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via 1 the phorumcheckxss function in common.php, 2 the EditError variable in profile.php, and 3 the Error variable in login.php...

CVE-2004-0035

SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the hideemail parameter...

Multiple Vulnerabilities in Phorum 3.4.5

Phorum 3.4.5 Vulnerabilities ----------------------------- Credit: Author: : Calum Power Versions : = 3.4.5 Vendor : Phorum Vendor URL : http://phorum.org Vendor Contacted: Yes Vendor Fix: Phorum has released Phorum v3.4.6 as a response to this advisory. Please patch your vulnerable software ASAP...

CVE-2004-0034

Multiple cross-site scripting XSS vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via 1 the phorumcheckxss function in common.php, 2 the EditError variable in profile.php, and 3 the Error variable in login.php...

CVE-2004-0034

CVE-2004-0034 affects Phorum 3.4.5 and earlier with multiple XSS vulnerabilities. The issues allow remote attackers to inject arbitrary HTML or web script through (1) phorum_check_xss in common.php, (2) EditError in profile.php, and (3) Error in login.php. The NVD metric reports a CVSS v2 base sc...

CVE-2004-0034: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via 1 the phorumcheckxss function in common.php, 2 the EditError variable in profile.php, and 3 the Error variable in login.php...

CVE-2003-1487

Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the 1 UserAdmin program, 2 Edit user profile, or 3 stats program...

CVE-2003-1465

Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files...

CVE-2003-1466

Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via 1 register.php or 2 login.php...

CVE-2003-1467

Multiple cross-site scripting XSS vulnerabilities in 1 login.php, 2 register.php, 3 post.php, and 4 common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors...

CVE-2003-1486

Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to 1 smileys.php, 2 quicklistrss.php, 3 purge.php, 4 news.php, 5 memberlist.php, 6 forumlistrss.php, 7 forumlistrdf.php, 8 forumlist.php, or 9 move.php, which leaks the...

CVE-2003-0283

Cross-site scripting XSS vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a "" before a tag name in the 1 subject, 2 author's name, or 3 author's e-mail...

CVE-2003-0283

Phorum prior to 3.4.3 is affected by a cross-site scripting (XSS) vulnerability in which an attacker can inject arbitrary script/HTML via a message whose subject, author name, or author e-mail is preceded by a "&lt;&lt;" before a tag name. This affects the handling of user-supplied content and ca...

CVE-2003-0283

Cross-site scripting XSS vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a "" before a tag name in the 1 subject, 2 author's name, or 3 author's e-mail...

Phorum Vulnerabilities

Phorum.org have acknowledged the flaws below and have released version 3.4.3 which corrects them. 1 The Phorum download program download.php is vulnerable to directory transversal attack and is able to read arbitrary files from anywhere within the root directory - with permissions of the web...

CVE-2003-0283: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a "" before a tag name in the 1 subject, 2 author's name, or 3 author's e-mail...

A Phorum&#39;s bug...

Hi! I have founded a bug in Phorum http://phorum.org/. It is possible to inject script code or other html-tag into "subject", "author's name" or "author's e-mail" of a message in Phorum. In the subject name, e-mail input of message you need to write any html-tag like this:...